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J.1 . (U)  American  Consulate  General  Mumbai's  Emergency  Action 
Committee  met  to  discuss  the  July  26,  2008  bombings  in 
Ahmedabad,  India.  Since  the  initial  attack  on  July  26,  2008  up 
to  fifteen  improvised  explosive  devices  have  been  found  and 
safely  disarmed  by  police  bomb  squad  personnel.  EAC  Mumbai 
continues  to  monitor  this  situation. 

J.2 . (SBU)  On  Saturday,  July  26,  2008,  16  to  17  improvised 
explosive  devices  (lEDs)  detonated  in  Ahmadabad,  the  major  city 
in  the  Indian  state  of  Gujarat.  The  devices  detonated  over  a 70 
minute  period  commencing  at  approximately  1845  with  the  final 
device  exploding  around  2000.  The  initial  blasts  appear  to  be 
low-intensity  lEDs  placed  in  markets,  residential  areas,  bus 
stops,  and  finally  hospitals.  It  appears  that  the  lEDs  at  three 
hospitals  were  timed  to  detonate  as  causalities  from  the  initial 
blasts  were  brought  for  treatment.  Media  reports  state  that  a 
vehicle  borne  improvised  explosive  devices  were  used  at  LG 
Hospital  and  the  Civil  Hospital.  The  VBIED  that  targeted  the 
Civil  Hospital  was  a Maruti  WagonR  with  a factory  installed  22.5 
liter  liquefied  petroleum  gas  (LPG)  tank.  The  bomb  makers  then 
packed  ammonium  nitrate  and  additional  liquefied  natural  gas 
(LNG)  cylinders  into  the  rear  hatch  back  storage  compartment  of 
the  WagonR  where  the  LPG  tank  was  installed.  At  this  time  all 
devices  appear  to  have  used  a timer  (possibly  a microprocessor) 
and  there  are  conflicting  reports  about  the  explosive 
composition  of  the  devices.  Approximately  50  people  were  killed 
in  the  attack.  American  Citizen  Services  personnel  have  received 
no  reports  of  American  citizens  killed  or  injured  in  the  attack. 

1[3 . (SBU)  Prior  to  the  attacks  in  Ahmedabad  an  email  was  sent  to 
a number  of  media  outlets  in  India  by  a group  professing  to  be 
the  Indian  Mujahideen  in  the  Land  of  Hind  claiming  credit  for 
the  attack,  and  promising  further  attacks  against  the  India 
states  of  Rajasthan,  Uttar  Pradesh,  Madhya  Pradesh,  Andra 
Pradesh,  Karnataka,  and  Maharashtra.  The  email  demands  the 
cities  of  Indore,  Ujjain,  Mumbai,  and  other  cities  in  Karnataka 
to  release  all  detained  members  of  the  Student  Islamic  Movement 
of  India  (SIMI)  or  else  these  cities  will  become  the  group's 
next  targets.  For  Maharashtra  the  email  threatens  action 
against  the  state  for  the  treatment  of  Madrasa  students  and 
Muslim  women  on  the  Western  railway  line.  The  group  also 
voiced  their  dissatisfaction  with  the  lack  of  prosecutorial 
action  against  the  perpetrators  of  1993  Mumbai  riots,  when 
compared  to  the  prosecution  of  Muslims  involved  in  the  1993 
Mumbai  serial  bombing.  Media  reporting  over  the  weekend  claimed 
that  the  Bombay  Stock  Exchange  was  listed  as  a potential  target 
in  the  email  which  is  not  accurate.  The  email  specifically 
mentions  Indian  industrialist  Mukesh  Ambani  for  "usurping" 
property  from  the  Muslim  Waqf  Board  to  build  his  new 
multi-million  dollar  residence  in  Mumbai.  The  property  was 
previously  an  orphanage.  A copy  of  the  email  has  been  forwarded 
to  DS/TIA/ITA. 


J.4 . (SBU)  Indian  police  and  security  services  determined  that 
the  email  was  sent  from  an  IP  address  that  resolved  to  an 
apartment  in  Navi  Mumbai,  a satellite  community  separated  from 
Mumbai  by  the  Thane  Creek.  At  approximately  2230  hours  on  July 
26,  2007  Mumbai  Police  Anti-Terrorist  Squad  (ATS)  officers 
appeared  at  the  apartment  rented  by  American  Kenneth  Lee 
Haywood,  initiating  a search  of  his  residence  and  began 
questioning  Haywood  about  the  email.  Consulate  personnel  first 
learned  of  the  Navi  Mumbai  email  connection  on  July  27,  2008 
when  coverage  in  the  Sunday  Times  of  India  stated  that  the 
Indian  Mujahideen  email  originated  from  Haywood's  apartment.  DS 
and  Consular  personnel  linked  Haywood's  to  an  American 
registered  with  the  Consulate.  Consular  Section  Chief  verified 
with  the  Mumbai  Police  that  Haywood  was  indeed  being  questioned 
by  ATS  personnel,  but  was  not  in  custody.  Latter  in  the  day  the 
Consular  Section  Chief  was  able  to  make  contact  with  Haywood  who 
stated  he  was  being  treated  well  and  was  cooperating  with  the 
investigation.  Haywood  did  note  that  there  was  a heavy  media 
presence  outside  his  residence.  ACS  personnel  spoke  with 
Haywood  on  July  28,  2008  and  related  that  the  Haywood  was  doing 
well,  but  that  ATS  personnel  had  sealed  his  apartment  office  and 
confiscated  his  hard  drive.  The  individuals  who  sent  the  email 
were  able  to  exploit  Haywood's  wireless  internet  service,  and 
send  the  email  via  his  IP  address.  ATS  personnel  have  not 
contacted  the  Consulate  for  assistance  in  the  case,  despite  ATS 
Chief  Hemant  Karkare  claiming  on  Monday  that  "we  have  requested 
the  US  Consulate  and  few  other  allied  agencies  to  assist  us  in 
verifying  Heywood's  background,"  to  Mumbai's  Daily  News  and 
Analysis.  ACS  personnel  have  maintained  regular  contact  with 
Haywood  since  Sunday. 

1[5 . (SBU)  Heywood's  corporate  attorney  provided  ACS  with  a series 
of  questions  from  Mumbai ' s Mid-Day  News  and  Haywood ' s answers  to 
those  questions: 
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Question:  When  did  you  realize  the  IP  address  had  been  hacked 
into? 

Answer:  Saturday  (26  Jul  08)  at  around  10pm  I received  a call 
from  the  ATS  in  Delhi  asking  if  I ran  a cyber  cafi.  I told  them 
no  I live  here.  Within  30  minutes,  the  ATS  were  at  my  door 
telling  me  my  internet  had  been  compromised. 

Question:  Do  you  use  wi-fi  to  connect  to  the  net?  If  yes,  do  you 
think  it  has  been  hacked  to  steal  your  IP  address?  If  not  do 
you  think  a cyber  hacker  used  software  to  clone  your  IP  address? 
Answer:  Yes,  I have  a wireless  router.  The  ATS  are  certain  that 
is  what  occurred. 

Question:  Is  your  laptop/desktop  secure? 

Answer:  All  computers  are  secure  within  my  flat.  However,  the 

Tata/VSNL  Technician  who  setup  the  wireless  router  said  it  was 
not  necessary  to  setup  security  because  the  computers  have 
firewalls.  He  also  disables  the  routers  logging  capability. 

Question:  What  did  the  cops  ask  you? 

Answer:  From  the  beginning  the  police  were  reassuring  me  that  I 
had  done  nothing  wrong.  They  wanted  to  know  who  had  access  to 
my  network.  I talked  to  them  for  72  hours.  They  asked  me  many 
questions.  The  most  often  asked  was  has  anyone  had  access  to  my 
computers?  (Only  my  family  and  the  Tata-VSNL  Technicians.) 

We've  come  to  know  now  that  the  router  was  not  secure. 

Question:  What  impression  (of  India,  its  police)  has  this 
incident  left  on  you? 

Answer:  The  police/ATS  have  been  very  professional  and 
courteous.  They  have  been  have  been  helpful  in  addressing  my 
concerns.  We  are  fully  confident  they  will  find  the  culprits  of 
this  horrific  act. 

Question:  Has  the  Anti-Terrorist  Squad  given  a clean  chit 
officially? 

Answer:  The  top  ATS  agents  have  continued  to  tell  me  how  we  have 
completely  cooperated.  They  have  said  nothing  has  been  found  to 
implicate  us.  We  have  not  been  arrested  nor  has  it  ever  been 


suggested  that  we  might  be.  I have  been  told  that  an  official 
statement  will  be  coming  soon.  ATS  in  Delhi  told  me  on  the 
phone  that  I was  completely  clear. 

Question:  Do  you  suspect  someone? 

Answer:  I don't  know  who  could  have  done  this.  The  police  are 
handling  the  investigation. 

Question:  What  is  your  biggest  fear? 

Answer:  I fear  for  the  safety  of  my  family. 

^6.  (SBU)  On  Sunday  July  27,  2008  two  additional  Maruti  WagonR 
vehicles  containing  explosives  were  found  in  Surat,  India.  Both 
vehicles  had  counterfeit  Gujarat  license  plates,  but  a search  of 
their  vehicle  identification  numbers  indicated  that  the  vehicles 
came  from  Maharashtra.  The  Marutis  were  stolen  from  the  Nerul 
area  of  Navi  Mumbai  before  being  equipped  with  Gujarat  license 
plates  and  moving  to  Surat.  On  July  28,  2008  post's  Senior 
Foreign  Service  National  Investigator  spoke  with  Surat  police 
contacts  to  gather  more  information  on  the  vehicles.  According 
to  police  sources  one  vehicle  contained  approximately  17  kg  of 
ammonium  nitrate  fuel  oil  mixture  (ANFO),  20  nine  volt 
batteries,  one  timer,  and  nuts  and  bolts  which  could  be  used  for 
fragmentation.  The  second  vehicle  contained  32  kg  of  ANFO,  30 
detonators,  and  one  battery.  It  us  still  unclear  if  the 
vehicles  were  actually  vehicle  borne  improvised  explosive 
devices,  or  vehicles  being  used  to  ferry  explosives  and  other 
materials  to  cells  operating  in  Gujarat. 

1L7  . (U)  Media  reports  on  July  29,  2008  thirteen  lEDs  were 

discovered  in  Surat  over  a four  hour  period.  Surat  Police  bomb 
squad  personnel  were  able  to  defuse  the  each  device.  The 
devices  were  found  in  the  Varacha  area  of  Surat.  One  device  was 
found  in  a tree  near  a police  post. 

1[8 . (SBU)  EAC  Mumbai  will  continue  to  track  the  incident  and 
provide  updates  as  necessary.  RSO  Mumbai  personnel  are  speaking 
with  contacts  in  Ahmedabad  to  confirm  the  design  of  the  lEDs  as 
well  as  to  gather  further  information  on  the  tactics,  techniques 
and  procedures  used  in  the  hospital  attacks.  Post  will  also 
work  to  develop  additional  information  on  the  two  explosive 
laden  vehicles  recovered  in  Surat.  RSO  Mumbai  plans  to  meet 
with  Haywood  on  July  30,  2008.  Post  does  note  that  both  the 
Surat  vehicles  and  the  Indian  Mujihadeen  email  originated  from 
Navi  Mumbai.  EAC  Mumbai  will  meet  on  July  30,  2008  to  discuss 
the  recent  targeting  of  Surat. 
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